Cisco Aironet Telnet Service User Account Enumeration Weakness

Bugtraq ID:	8292
Class:	Design Error
CVE:	CVE-2003-0512
Remote:	Yes
Local:	No
Published:	Jul 28 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Discovery credited to Reda Zitouni.
Vulnerable:	Cisco IOS 12.2(8)JA Cisco IOS 12.2(4)JA1 Cisco IOS 12.2(4)JA Cisco IOS 12.2(16.1)B Cisco IOS 12.2(16)B Cisco IOS 12.2(15.1)S Cisco IOS 12.2(15)ZN Cisco IOS 12.2(14.5)T Cisco IOS 12.2(14.5) Cisco IOS 12.2(11)JA1 Cisco IOS 12.2(11)JA Cisco IOS 12.0(24.2)S Cisco IOS 12.0(24)S1
Not Vulnerable:

Cisco Aironet Telnet Service User Account Enumeration Weakness

An information leak has been reported in Cisco Aironet Access Points when the telnet service has been enabled. This may allow a remote attacker to gain potentially sensitive information.

Cisco Aironet Telnet Service User Account Enumeration Weakness

Solution:
Cisco has released updates to address this issue. Please see the attached advisory for details on obtaining and applying updates.

Cisco Aironet Telnet Service User Account Enumeration Weakness

References:

• Enumerating Locally Defined Users in Cisco IOS (Cisco)
  
• Cisco Aironet AP 1100 Malformed HTTP Request Crash Vulnerability (zitouni "réda" )